Pimcore Studio API Privilege Escalation via Class Definition Endpoint

Pimcore Studio API, specifically the pimcore/studio-backend-bundle, contains a security flaw where the class definition creation endpoint is protected by the objects permission rather than the intended classes permission. This vulnerability, tracked as CVE-2026-55212, allows standard authenticated users with content editing rights to perform administrative actions.

When exploited, this allows unauthorized users to generate new database tables and create PHP class files on the application server. This bypasses the security controls enforced in the Classic Admin interface. Additionally, the API lacks proper input validation for the uid parameter at the controller layer, which can lead to unhandled internal exceptions and potential information disclosure, such as stack traces, depending on the server's debug configuration. Affected versions are those earlier than 2025.4.6 and versions within the 2026.1.x range prior to 2026.1.6.

Attack Chain

1. Attacker authenticates to the Pimcore application using credentials of a user account possessing only the objects permission.
2. Attacker interacts with the Studio API at POST /pimcore-studio/api/class/definition/configuration-view/detail/create.
3. The application's CreateController incorrectly validates the user's authorization against the DATA_OBJECTS permission.
4. Attacker provides a JSON payload containing a class name and an arbitrary uid value.
5. The API boundary performs only a basic empty-string check, allowing malformed or unauthorized uid data to proceed.
6. The Pimcore model layer processes the request, creating new database tables in the backend.
7. The system generates new PHP class files on the server based on the user-provided definition.
8. Final objective achieved: Unauthorized schema modification and potential execution of malicious object structures.

Impact

Successful exploitation results in privilege escalation from a standard editor-level user to an administrative-level structural capability. An attacker can modify the application schema, potentially corrupting existing data models or introducing backdoored class structures. Furthermore, the lack of input validation on the uid parameter can lead to server-side exceptions, potentially exposing sensitive environment details via stack traces in error responses.

Recommendation

Prioritized actions for security and IT teams:

• Patch Pimcore studio-backend-bundle to version 2025.4.6 or 2026.1.6 or later to address CVE-2026-55212.
• Audit existing class definitions for unauthorized entries created by non-admin users.
• Review web server logs for HTTP POST requests to /pimcore-studio/api/class/definition/configuration-view/detail/create originating from non-administrative user sessions.
• Disable debug mode in production environments to prevent the disclosure of internal stack traces triggered by malformed API inputs.